Claude Code team says the account email will leave the model's context next week

Lydia Hallie, who says she works on Claude Code, wrote on Hacker News that the team is removing the account email address from the context Claude Code gives the model, in a release she expects early next week. She says the address was added for signed-in users because Claude would hallucinate names in @author tags. When Claude wrote a command itself, such as a curl call, it sometimes put the address in the User-Agent as a contact address, because some sites ask automated clients for one. Until the release ships, she says versions 2.1.317 and later include a built-in mod, on by default, that asks before Claude runs a web tool call or curl-style command containing the email. She adds that it "still doesn't prevent all cases, like when Claude writes a script and runs on its own," and that the stable channel was still on 2.1.311 when she wrote.

Tin Analytics reports five different email-bearing User-Agent strings requesting one of its articles on October 31, with the addresses already redacted in the records it queried. It says that does not show Claude Code sent them, or that the addresses were personal. It also counted 275 requests from the standard Claude-User (claude-code/ label between October 27 and November 5 (71 on one of its sites, 204 on another), and none contained an email address. Tin's reading of the mod's published README is that it does not cover WebFetch, WebSearch, MCP tools or scripts containing the address; we have not checked the README ourselves. The reporter's claim in the original GitHub issue that the leak caused scam email remains the reporter's claim.

Why it matters: The vendor's own account is that the email reached outgoing requests because it sat in the model's context, so the fix is removing it from context rather than filtering requests. Until that release, a check of outbound headers in scripts the agent writes and runs is the case the mod does not cover.